https://www.gpldownloads.com/downloads/user-role-editor/changelog/
Black Friday Month

33% off all membership plans Excludes the Developers plan

See plans
Auto Updates
Latest Updates
Log inGet Started
Back to User Role Editor Pro

User Role Editor Pro changelog

Release notes for every version we have on record, newest first.

Latest 4.67 · 4 Nov 2026 40 versions Since Mar 2020

2026 7 versions

4.67 Latest 4 Nov 2026 1 new2 improved1 fixed1 security1 changed
New
  • New (core): custom filter 'ure_get_critical_capabilities' allows to modify the list of critical capabilities used for the role assignment check. 'manage_options', 'activate_plugins', 'delete_plugins', 'edit_users', 'delete_users' capabilities are under control by default.
Improved
  • Update (core): allow users with only the 'promote_users' capability to use the "Without role" button.
  • The site URL (the 'siteurl' option value) is sent to the URE Pro update server with update checking/download request.
Fixed
  • Fix (core): "Without role" button on the Users page stopped working (showed "Please select at least one item to perform this action on." after role selection).
Security
  • Security fix (core): Users page: Change Role, Grant Role, Add Role: a user with the "promote_users" capability could grant themselves (or others) roles with capabilities beyond their own, when custom high-privilege roles existed on the site. Role assignment now requires that the acting user already holds all critical capabilities of the target role; self-assignment of roles is no longer allowed...
Changed
  • Core version: 4.67
4.66.4 27 Oct 2026 3 new5 improved6 fixed1 changed
New
  • "Current user Media only" option. Turn it on at Settings > Additional Modules, then tick "Current user Media only" in the "Additional Options" section of the role editor for any role: users with that role see only the media items they uploaded themselves in the Media Library (wp-admin only; administrators are not restricted). Use the 'ure_attachments_show_full_list' filter (return true) to show...
  • Brazilian Portuguese (pt_BR) translation was added. Thanks to Jayron Castro.
  • New (core): 'ure_get_blog_ids_args' filter allows to exclude archived, spam and deleted sites from the list of network sites processed by the plugin (e.g. when a role change is applied to all sites of the network). Return an array with any of 'archived', 'spam', 'deleted' keys set to 0 (exclude such sites) or 1 (process such sites only), e.g. array( 'archived' => 0, 'spam' => 0, 'deleted' => 0...
Improved
  • Marked as compatible with WordPress version 7.2
  • Required PHP version increased up to 8.2
  • Admin menu access add-on: the code which applies admin menu restrictions was moved to the separate URE_Admin_Menu_Access_Restrict class, which is not loaded for superadmin at all, as URE Pro does not restrict superadmin. URE_Admin_Menu_Access class keeps the code required for every user: Admin Menu access UI, admin menu copy update.
  • "Admin Menu", "Gravity Forms Access", "Meta Boxes", "Nav Menus", "Other Roles", "Plugins", "Posts Edit" and "Widgets Admin" add-ons dialogs JavaScript: the own copy of the AJAX request success handler, identical to the core one, was removed; the core ure_main.update_success() is used instead.
  • Admin menu access add-on: unused code was removed from URE_Admin_Menu_Copy::get_submenu(): it added the "Profile" item to a local copy of the admin menu, which was not used. URE_Admin_Menu_Copy::get_menu() adds this item to the admin menu copy.
Fixed
  • Content view restrictions add-on: restricted posts were not excluded from the front-end posts lists (home page, search results, archives) and from other posts queries, which do not set a single post type: post type is not set at all, set as an array of post types or as 'any'. The check "restrictions are applied to the public custom post types only" added in version 4.63 skipped such queries. No...
  • Content view restrictions add-on: the access error action set for a role/user was not loaded under PHP 8, when a post was blocked at the roles level: a string constant was compared with 0 instead of the current access error action value. URE_Content_View_Restrictions::get_access_error_action() returned 0, and the redirect access error action set via the 'ure_content_view_access_data_for_user' o...
  • Admin menu access add-on: Remove only menu items, which submenu was emptied as blocked by URE itself. Some plugins/themes (e.g. Hello Elementor) intentionally remove all their submenu items at 'admin_head' to show a top level menu item only, and URE Pro removed such top level menu item.
  • Admin menu access add-on: a top level menu item, which is a submenu item for administrator (the admin menu copy is made for administrator), was not removed from menu when blocked (not allowed) for another role. Example: Wordfence "Login Security" page is a submenu item under "Wordfence" for users with 'activate_plugins' capability and a top level menu item for other users. Now restrictions set...
  • Several labels on the "About" box ("User Role Editor", "User Role Editor Pro", "Version:", "Plugin URL:", "Download URL:", "Author:", "Send support question") and the "Reset User Roles" heading at the Settings > Tools tab were hardcoded in English and could not be translated. The misspelled "Dowload URL:" label was corrected to "Download URL:".
  • Fix (core): Multisite: only the first 100 sites of a network were processed when a role change was applied to all sites of the network, network add-ons data was replicated, a role was imported to all sites, and plugin data was cleaned up on uninstall, as get_sites() (used by URE_Base_Lib::get_blog_ids() since version 4.66) returns 100 sites max by default.
Changed
  • Core version: 4.66.3
4.66.3 25 Sep 2026 2 fixed1 security1 changed
Fixed
  • The "Grant Roles" dialog's AJAX request (get_grant_roles) incorrectly required the plugin's own key capability instead of "promote_users", refusing users who only had "promote_users" - the capability the Grant Roles feature is designed for - with an "Insufficient permissions" error.
  • "Posts Edit Access" add-on: a user restricted (Allow model) to a specific category, post ID list, or author no longer could create a new post/page once they already had at least one matching item, because the "just clicked Add New" bypass in URE_Posts_Edit_Access::block_edit_post() only recognized the classic-editor save request, not the plain page load that immediately follows creating the new...
Security
  • Administrator-role protection (URE_Protect_Admin::exclude_admin_role()) only excluded the "administrator" role from the assignable-roles list on the classic user edit screens, not on the plugin's own admin-ajax.php actions; a user holding the "promote_users" capability (without the plugin's own key capability) could therefore grant themselves or another user the "administrator" role via the "Ad...
Changed
  • Core version: 4.66.2
4.66.2 15 Sep 2026 1 fixed1 changed
Fixed
  • Opening the "Admin Menu", "Plugins", "Posts Edit", "Posts View", "Meta Boxes", "Widgets Admin", "Nav Menus", "Other Roles", "Gravity Forms Access" or "Import Role" dialog from the role editor toolbar threw a JavaScript "ure_ui_button_text is not defined" error and left the dialog's buttons unstyled, caused by the 4.66.1 core ure.js refactor renaming that helper to ure_main.ui_button_text() with...
Changed
  • Core version: 4.66.2
4.66.1 15 Sep 2026 11 improved9 fixed1 security2 changed
Improved
  • Redirects to same-site URLs now use wp_safe_redirect(); deprecated/discouraged PHP and WordPress function calls (get_terms(), parse_url(), unlink(), date()) were replaced with their recommended equivalents across several add-ons.
  • "Delete Role" dialog now lists deletable roles in a checkbox table (Role Name / Role ID columns) instead of a single-select dropdown, so multiple roles can be deleted in one action; the old "Delete All Unused Roles" option is replaced by a "select all" checkbox in the table header.
  • "Delete Capability" dialog now has a "Quick Filter" text field next to its "select all" checkbox, to narrow down the capability list the same way the main page's "Quick filter" field does.
  • The multisite "Allow non super administrators to create, edit, and delete users" option is narrowed to "Allow non super administrators to edit users". The "create" part duplicated WordPress core's own "Allow site administrators to add new users to their site via the 'Users -> Add User' page" network setting, and the "delete" part granted a capability that WordPress core never actually lets a si...
  • Plugin's own core JavaScript files (ure.js, settings.js, users.js, user-profile-other-roles.js, users-grant-roles.js) now have minified .min.js builds, generated with esbuild; each is enqueued via WordPress's SCRIPT_DEBUG constant, same convention already used for the vendored notify.js/multiple-select.js (unminified source when SCRIPT_DEBUG is on, minified build otherwise).
  • Plugin's own core CSS (css/ure-admin.css) now has a minified .min.css build, generated with esbuild; it's enqueued via WordPress's SCRIPT_DEBUG constant, same convention already used for the plugin's own JS files (unminified source when SCRIPT_DEBUG is on, minified build otherwise).
  • Js/users-grant-roles.js's loose global functions (Grant Roles dialog, Add/Revoke role buttons on the Users page) were consolidated into a single URE_Users_Grant_Roles object.
  • Replaced the deprecated jQuery .click()/.click(fn) event-binding shorthand with .on('click', fn) in users-grant-roles.js and users.js, clearing a jQuery Migrate deprecation warning on the Users page.
  • Js/users.js's loose global functions (the "Without role" button's dialog on the Users page) were consolidated into a single URE_No_Role_Users object; the button's onclick markup in URE_Assign_Role::show_html() was updated to match.
  • Js/user-profile-other-roles.js's loose global functions (the user profile "Other Roles" multi-select control) were consolidated into a single URE_User_Profile_Other_Roles object.
  • Js/settings.js's loose global functions (the Settings page's "Reset User Roles" confirmation dialog) were consolidated into a single URE_Settings object.
Fixed
  • A late static binding bug in URE_Core::valid_php_version()/valid_wordpress_version() (self:: instead of static::) silently ignored Pro's overridden minimum required WordPress version.
  • "Other Roles Access" and "Posts Edit Access" add-ons used an invalid SQL placeholder that quoted an already-prepared, comma-separated ID list as a single string, silently breaking the "exclude users with blocked roles" admin filtering and the "auto-assign default term" logic for new posts.
  • Three strings across the "Widgets Show/Admin Access" and "Front-End Menu Access" add-ons used a mistyped text domain, so they were never translated.
  • "Widgets Admin Access" add-on called an internal-use-only WordPress function; replaced with a safe equivalent.
  • "Front-End Menu Access" add-on was missing a check on a submitted menu item value.
  • Multisite role import now checks the target site actually exists before querying its data, instead of relying on a raw database error for a nonexistent site.
  • Posts edit access add-on: Selected post types were not saved at user profile.
  • "Add Role" dialog kept showing the previously entered Role name (ID) and Display Role Name after a role was added, instead of blank fields.
  • Opening a user's edit-profile screen and leaving without making any changes could show a spurious "Changes you made may not be saved" browser warning whenever the user had any "Other Roles" assigned; the Other Roles multi-select now renders its selected options directly in HTML instead of relying on JavaScript to select them after page load.
Security
  • Broad output-escaping, input-sanitization, and SQL-query-preparation hardening pass across the Pro-only code, following a full WordPress.org Plugin Check audit.
Changed
  • Core version: 4.66.2
  • Core version was update to 4.66.2
4.66 25 Aug 2026 16 improved15 fixed2 security2 changed
Improved
  • Marked as compatible with WordPress 7.1
  • Plugin loading code is enhanced.
  • Plugin does not use self-defined PHP global constants. Needed data moved inside classes.
  • "Admin menu access" add-on: White list of URL arguments allowed by default for WooCommerce products and shop orders list pages was updated.
  • URE_Uninstall_Pro::init_options_list() now references addon classes own *_KEY constants instead of duplicating their option name strings.
  • Core version was updated to 4.66.1
  • URE_Admin_Notice class output was escaped with esc_attr(), wp_kses_post() functions.
  • Nonce actions used on the Settings/Tools pages are now scoped per form (ure_settings_update, ure_addons_settings_update, ure_default_roles_update, ure_settings_ms_update, ure_settings_tools_exec) instead of one shared string.
  • Additional output escaping was added across URE_View, URE_Role_View and URE_Role_Additional_Options (role/capability slugs, wp_json_encode() instead of json_encode(), esc_url() on form actions), plus a defense-in-depth capability check in URE_Role_Additional_Options::save().
  • Rel="noopener noreferrer" was added to external links opened with target="_new".
  • Hardcoded text strings in the role editor toolbar are now translatable.
  • $_SERVER['REQUEST_URI'] is now validated and unslashed before sanitizing in URE_Lib::is_right_admin_path() and URE_User_Other_Roles::is_user_profile_extention_allowed().
  • Posted role IDs are now sanitized (sanitize_key(), wp_unslash()) in URE_Editor, and its 'object'/role-selection request parameters are constrained to known values.
  • URE_Base_Lib::get_blog_ids() now uses get_sites() instead of a raw database query.
  • URE_Capability::revoke_caps() now uses get_users() instead of a raw database query.
  • URE_Protect_Admin::has_administrator_role() now uses user_can() instead of a raw database query.
Fixed
  • URE_Assign_Role_Pro::get_users_queued() referenced an undefined constant instead of self::CRON_ACTION_HOOK.
  • URE_Assign_Role_Pro::assign_role_to_user() used a loose in_array() check against $user->caps that was always true, so the background role-assignment feature never actually assigned the role; now correctly checks $user->roles.
  • "Posts Edit Access" bulk action's user ID list could contain stray whitespace instead of clean integers; user IDs are now properly cast to int.
  • Activating Pro while the free plugin was already active still left both active in some load orders, because URE_Core_Pro::init() (which registered the fix above) was itself skipped when the free plugin had already defined URE_Loader/URE_Core earlier in the same request; the activation-hook registration now happens unconditionally via a standalone function in the main plugin file.
  • URE_Protect_Admin used a bitwise "&" instead of a logical "&&" when checking a capabilities array, which could throw a PHP 8 TypeError; fixed to use "&&", and the related IN() SQL clause is now hardened with array_map('absint', ...).
  • URE_Assign_Role used the %i SQL placeholder, which needs WordPress 6.2+, below the plugin's declared minimum; replaced with direct interpolation of internal table names.
  • URE_Editor::reset_user_roles() had an unescaped wp_die() message; further output escaping (esc_url(), esc_html(), absint()) was added across URE_Base_Lib, URE_Editor, URE_User_Other_Roles and URE_User_View.
  • Several request-var/database-result comparisons that could be bypassed by PHP type juggling are now strict, including URE_Grant_Roles::is_try_remove_admin_from_himself()'s "can't remove your own admin role" check.
  • URE_Base_Lib::set() now correctly rejects unknown properties instead of silently creating them; URE_View declares its $advert property explicitly.
  • URE_Assign_Role::$lib property was changed to protected.
  • URE_Uninstall::delete_options() private function changed to protected.
  • URE_Uninstall::init_options_list() referenced 'ure_task_queue', which never matched URE_Task_Queue::OPTION_NAME ('ure_tasks_queue'), so that option was never deleted on uninstall.
  • URE_Core::define_files() - class URE_Uninstall was not added correctly, null was written instead of class name.
  • Activating Pro while the free version was already active caused a fatal "Cannot redeclare ure_log_error()" error; the function declaration is now guarded with function_exists().
  • Activating this plugin while the paired Pro plugin was already active silently left both active instead of deactivating the paired one, because the register_activation_hook() call never ran in that request; it's now registered as a standalone function directly in the main plugin file, ahead of the class_exists('URE_Loader') guard that was skipping it.
Security
  • SQL queries in URE_Editor::direct_network_roles_update() and leave_roles_for_blog() are passed to $wpdb->prepare() with real %s placeholders.
  • URE_Editor::get_caps_columns_quant() now requires a valid nonce before writing a display-preference transient from $_POST, closing a minor CSRF gap.
Changed
  • Core version: 4.66.1
  • Required PHP version increased up to 7.4
4.65 21 May 2026 12 improved6 fixed1 changed
Improved
  • Marked as compatible with WordPress 7.0
  • Minor fixes to pages markup are applied to correspond WordPress 7.0 CSS changes.
  • "defined('ABSPATH')" guard was added to all PHP files to exclude PHP files direct execution.
  • Sanitize_text_field(), sanitize_key(), sanitize_url() functions are used to secure user input before processing.
  • _nonce field checking was added before data update in addition checking made already on the higher level.
  • Core version was updated to 4.65
  • Meta Boxes Access add-on: data is updated via AJAX without full page refresh now.
  • Other Roles Access add-on: data is updated via AJAX without full page refresh now.
  • Posts Edit Access add-on: data for role is updated without full page refresh via AJAX now.
  • Plugins Access add-on: data is updated via AJAX without full page refresh now.
  • Import role CSV: uploaded file .csv extention and mime type checking were added.
  • "Users->User Role Editor->Import" button is hidden in case page is opened from the WP Multisite -> Network admin. Use it from the selected single site only.
Fixed
  • Users->User Role Editor->Import: single user role was imported successfully but the empty page was shown instead of URE page with successful import notification.
  • Meta Boxes Access add-on: WP Multisite: Network Admin->Users->User Role Editor->Meta Boxes: current role does not lose now all capabilities after the 'Update' button click.
  • Other Roles Access add-on: WP Multisite: Network Admin->Users->User Role Editor->Other Roles: current role does not lose now all capabilities after the 'Update' button click.
  • Posts Edit Access add-on: WP Multisite: Network Admin->Users->User Role Editor->Posts Edit: current role does not lose now all capabilities after the 'Update' button click.
  • Plugins Access add-on: WP Multisite: Network Admin->Users->User Role Editor->Plugins: current role does not lose now all capabilities after the 'Update' button click.
  • Export roles CSV download file with .pdf extension in the FireFox browser. Content type header was replaced to 'text/plain'.
Changed
  • Core version: 4.65

2025 2 versions

4.64.6 3 Dec 2025 5 improved1 changed
Improved
  • Marked as compatible with WordPress 6.9
  • Gravity Forms Access add-on: Form switcher drop-down list includes only forms allowed for the current user.
  • Core version was updated to 4.64.6
  • Minor code enhancements according to the "Plugin Check" tool recommendations.
  • "Users->Grant Roles" HTML code download optimization to exclude cases when URE's "Grant Roles" data flickers or stays visible while Users page is opening.
Changed
  • Core version: 4.64.6
4.64.5 17 Apr 2025 3 improved2 fixed2 changed
Improved
  • Marked as compatible with WordPress 6.8
  • Core version was updated to 4.64.5
  • Minor changes were applied to the CSS/JS loading code to minimize "Plugin Check" tool warnings.
Fixed
  • PHP Deprecated: URE_Widgets_Admin_View::get_html(): Implicitly marking parameter $user as nullable is deprecated, the explicit nullable type must be used instead in /wp-content/plugins/user-role-editor-pro/pro/includes/classes/widgets-admin-view.php on line 133
  • PHP Notice: Function _load_textdomain_just_in_time was called incorrectly. Translation loading for the user-role-editor domain was triggered too early. This is usually an indicator for some code in the plugin or theme running too early. Translations should be loaded at the init action or later. pro/includes/classes/addons-manager.php called esc_html() from constructor. Moved to the 'init' action.
Changed
  • Core version: 4.64.5
  • Plugin headers were extended at role-editor.php and readme.txt files according to wordpress.org recommendations.

2024 3 versions

4.64.4 15 Dec 2024 1 improved1 security1 changed
Improved
  • Core version was updated to 4.64.4
Security
  • Users - "Add Role", "Revoke Role" buttons: Cross-Site request forgery to privilege escalation was possible due to missed nonce validation. This issue was discovered and responsibly reported by vgo0.
Changed
  • Core version: 4.64.4
4.64.3 4 Dec 2024 2 improved2 fixed1 changed
Improved
  • Marked as compatible with WordPress 6.7.1
  • Core version was updated to 4.64.3
Fixed
  • PHP Notice: "Function _load_textdomain_just_in_time was called incorrectly. Translation loading for the user-role-editor domain was triggered too early." was fixed (shown only for those who used own .mo translation file installed).
  • Miscellaneous translation functionality (l18n) usage enhancements were applied.
Changed
  • Core version: 4.64.3
4.64.2 26 Mar 2024 10 improved6 fixed1 removed2 changed
Improved
  • Marked as compatible with WordPress 6.5
  • Content view restrictions add-on: historically if field "For users" was empty, URE applies "Selected Roles" to the existing post (in case it was not assigned yet), but a default value set by user at URE Settings is applied in both cases, for new added and existing posts.
  • Core version was updated to 4.64.2
  • URE_Advertisement: rand() is replaced with wp_rand().
  • URE_Ajax_Proccessor: json_encode() is replaced with wp_json_encode().
  • User_Role_Editor::load_translation(): load_plugin_textdomain() is called with the 2nd parameter value false, instead of deprecated ''.
  • URE_Lib::is_right_admin_path(): parse_url() is replaced with wp_parse_url().
  • URE_Lib::user_is_admin() does not call WP_User::has_cap() to enhance performance.
  • Plugin version was added to CSS loaded to the "Users", "Users->User Role Editor", "Settings->User Role Editor" pages.
  • All JavaScript files are loaded in footer now.
Fixed
  • Posts/pages edit restrictions add-on: endless recursion calls issue (conflict with "The Events Calendar" plugin) was fixed.
  • Admin menu access add-on:
  • Wp-admin pages permissions viewer: Undefined array key -1 in /wp-content/plugins/user-role-editor-pro/pro/includes/classes/page-permissions-view.php on line 137
  • Deprecated: explode(): Passing null to parameter #2 ($string) of type string is deprecated in wp-content/plugins/user-role-editor-pro/pro/includes/classes/utils.php on line 181
  • Notice: Array to string conversion in wp-content/plugins/user-role-editor-pro/pro/includes/classes/posts-edit-access-user.php on line 965
  • "Users->Add New Users". Unneeded extra '' HTML tags was removed (thanks to Alejandro A. for this bug report).
Removed
  • - strpos(): Passing null to parameter #1 ($haystack) of type string is deprecated in /wp-content/plugins/user-role-editor-pro/pro/includes/classes/admin-menu-view.php on line 253
Changed
  • Core version: 4.64.2
  • - full URL (including domain) was used for some menu items. For this reason checkboxes of such menu items may lose selection in case of replication of admin menu restrictions to all subsites under WP multisite. Re-check your admin menu access settings just in case mentioned menu items became unchecked after this update.

2023 3 versions

4.64.1 30 Oct 2023 2 improved8 fixed1 changed
Improved
  • Filter 'ure_check_updates' was added. It's return true by default. Return false from it to switch off automatic checking if new version of URE is available. It would be useful if you use URE behind corporate firewall and it does not have access to the Internet.
  • Core version was updated to 4.64.1
Fixed
  • Notice shown by PHP 8.3 is removed: PHP Deprecated: Creation of dynamic property URE_Export_Single_Role::$editor is deprecated in wp-content/plugins/user-role-editor-pro/pro/includes/classes/export-single-role.php:23
  • Notice shown by PHP 8.3 is removed: PHP Deprecated: Creation of dynamic property PluginInfo_1_3::$requires_php is deprecated in /wp-content/plugins/user-role-editor-pro/pro/includes/plugin-update-checker.php on line 801
  • Notice shown by PHP 8.3 is removed: PHP Deprecated: Creation of dynamic property PluginInfo_1_3::$license_state is deprecated in /wp-content/plugins/user-role-editor-pro/pro/includes/plugin-update-checker.php on line 801
  • Notice shown by PHP 8.3 is removed: PHP Deprecated: Creation of dynamic property PluginInfo_1_3::$request_time_elapsed is deprecated in /wp-content/plugins/user-role-editor-pro/pro/includes/plugin-update-checker.php on line 801
  • Content view restrictions add-on: Undefined array key 0 in user-role-editor-pro/pro/includes/classes/post-types-own-caps.php on line 93
  • Notice shown by PHP 8.3 is removed: PHP Deprecated: Creation of dynamic property URE_Editor::$hide_pro_banner is deprecated in /wp-content/plugins/user-role-editor/includes/classes/editor.php on line 166
  • Notice shown by PHP 8.3 is removed: PHP Deprecated: Creation of dynamic property URE_Role_View::$caps_to_remove is deprecated in /wp-content/plugins/user-role-editor/includes/classes/role-view.php on line 23
  • Notice shown by PHP 8.3 is removed: PHP Deprecated: Function utf8_decode() is deprecated in /wp-content/plugins/user-role-editor-pro/includes/classes/editor.php on line 984
Changed
  • Core version: 4.64.1
4.64 8 Aug 2023 3 improved3 fixed1 changed
Improved
  • Admin menu access add-on: Block "Sales Reports" menu automatically, if WooCommerce->Reports menu item is blocked
  • Core version was updated to 4.64
  • "Show capabilities in human readable form" checkbox switches between capability 2 text forms without full page reloading using JavaScript.
Fixed
  • PHP Warning: Trying to access array offset on value of type bool in /wp-content/plugins/user-role-editor-pro/pro/includes/classes/admin-menu-access.php on line 356
  • PHP Warning: Undefined array key "message" in /wp-content/plugins/user-role-editor-pro/pro/includes/classes/ajax-processor.php on line 228
  • Missed 'message' parameter was added to response for AJAX query. It fixed the potential PHP Warning: Undefined array key "message" in expressions like "strpos( $data['message'], ...
Changed
  • Core version: 4.64
4.63.5 28 Mar 2023 2 improved4 fixed1 changed
Improved
  • Front-end menu view add-on: CSS was changed for URE controls to not overlap with other elements.
  • Core version was updated to 4.63.3
Fixed
  • Content view restrictions add-on: Now a CVR meta box is added to a term edit page after checking of 'ure_content_view_access' permission.
  • PHP version 8.2 showed warning: Creation of dynamic property User_Role_Editor::$settings_page_hook is deprecated : wp-content/plugins/user-role-editor/includes/classes/user-role-editor.php:603
  • PHP Fatal error: Uncaught TypeError: in_array(): Argument #2 ($haystack) must be of type array, int given in /www/wp-content/plugins/user-role-editor/includes/classes/view.php:81
  • PHP Parse error: syntax error, unexpected ‘:’, expecting ‘;’ or ‘{‘: wp-content/plugins/user-role-editor/includes/classes/base-lib.php on line 119, type declarations were removed for compatibility with older PHP versions.
Changed
  • Core version: 4.63.3

2022 8 versions

4.63.4 16 Dec 2022 4 improved3 fixed3 changed
Improved
  • Array_merge() function is replaced with wrapper ure_array_merge(), to exclude fatal error: Argument #2 must be of type array.
  • Core version was updated to 4.63.2
  • Symbols '{}$' are removed from capability name before use it for internal purpose, to exclude cases like when one of plugins broke URE work adding capability like 'edit_{$type}s'.
  • Array_merge() function is replaced with wrapper ure_array_merge(), to exclude fatal error: Argument #2 must be of type array.
Fixed
  • Edit posts restrictions add-on:
  • PHP Fatal error: Uncaught TypeError: array_key_exists(): Argument #2 ($array) must be of type array, null given in /wp-content/plugins/user-role-editor-pro/pro/includes/classes/admin-menu-view.php:380
  • PHP Warning: Trying to access array offset on value of type bool in /wp-content/plugins/user-role-editor-pro/pro/includes/classes/admin-menu-access.php on line 353
Changed
  • Core version: 4.63.2
  • - Full list of posts was shown for user with "Own data only" turned ON in case user did not have any own post.
  • - Full list of terms/categories was available at the post editor for selection for user with restricted access by terms/categories.
4.63.3 2 Nov 2022 1 fixed1 changed
Fixed
  • Navigation menu admin access add-on: Warning: Attempt to read property “slug” on int in /wp-content/plugins/user-role-editor-pro/pro/includes/classes/nav-menus-admin-access.php on line 73
Changed
  • Core version: 4.63.1
4.63.2 29 Sep 2022 1 improved2 fixed1 changed
Improved
  • Edit access restrictions add-on: It skips Elementor's internal custom post types to reduce general time execution.
Fixed
  • Admin menu access add-on: Error message: Uncaught TypeError: in_array(): Argument #2 ($haystack) must be of type array, null given in /wp-content/plugins/user-role-editor-pro/pro/includes/classes/admin-menu-access.php:522
  • Edit access restrictions add-on: Prohibit by selected posts ID list criteria worked incorrectly - all posts were prohibited instead of selected only.
Changed
  • Core version: 4.63.1
4.63.1 21 Sep 2022 3 improved3 fixed2 changed
Improved
  • Admin menu access add-on: URL Parameters White List: convert parameter name to lower case before processing.
  • German translation was updated.
  • Core version was updated to 4.63.1
Fixed
  • Edit access restrictions add-on: It was possible to open a post from a prohibited post type for editing via direct link by post ID, like /wp-admin/post.php?post=NN&action=edit
  • PHP Warning: Attempt to read property “ID” on null in ./includes/classes/user-role-editor.php on line 369
  • Deprecated: Automatic conversion of false to array is deprecated in ./includes/classes/base-lib.php on line 212
Changed
  • Core version: 4.63.1
  • Marked as compatible with WordPress version 6.0.2
4.63 3 Aug 2022 2 new6 improved2 fixed1 changed
New
  • Edit restrictions access add-on: It's possible allow/prohibit for role or user the selected post types: posts, pages, custom post types.
  • It's possible to translate custom role names using PolyLang plugin.
Improved
  • Marked as compatible with WordPress 6.1
  • Content view restrictions add-on: restrictions are applied to the public custom post types only.
  • Few notices (e.g. "Constant FILTER_SANITIZE_STRING is deprecated") was fixed for better compatibility with PHP 8.1.
  • Core version was updated to version 4.63
  • URE does not sort roles in WordPress dropdown lists. In order to sort roles by name return 'name' from 'ure_sort_wp_roles_list' filter.
  • User capabilities view page minor CSS enhancements.
Fixed
  • Content view restrictions add-on: Fatal error: Uncaught InvalidArgumentException: target should be an object with map method or an array in /wp-content/plugins/sitepress-multilingual-cms/vendor/wpml/fp/core/Fns.php:156 URE tried to check if not logged-in user can edit the post, by its ID. This leaded to a problem inside WPML plugin code.
  • Content edit restrictions: "Force custom post types to use their own capabilities" option: URE automatically created custom post types unique capabilities later then "Fusion Builder" plugin did. 'init' action was replaced with 'wp_loaded' one.
Changed
  • Core version: 4.63
4.62.1 29 Mar 2022 1 improved1 fixed4 changed
Improved
  • Marked as compatible with WordPress 5.9.2
Fixed
  • Gravity Forms access add-on:
Changed
  • Core version: 4.61.2
  • - Uncaught Error: Call to undefined method URE_GF_Access_User::get_fg_list() in /wp-content/plugins/user-role-editor-pro/pro/includes/classes/gf-access-user.php:211
  • - All Gravity Forms were available for the user in spite of the restrictions set for him in some cases.
  • - Button "Gravity Forms" did not work at "Users->User Role Editor" page.
4.62 7 Mar 2022 2 new3 improved1 fixed1 changed
New
  • It's possible to import all user roles at once from previously exported CSV file.
  • "Edit posts restrictions" add-on: It's possible to replicate settings from the main site to all other subsites of the multisite network (Network admin->Users->User Role Editor->Update Network).
Improved
  • Marked as compatible with WordPress 5.9.1
  • Core version was updated to version 4.61.2
  • URE uses WordPress notification styles for own operation result output.
Fixed
  • "Users->Add New" page - other selected roles were not saved.
Changed
  • Core version: 4.61.2
4.61 31 Jan 2022 2 new6 improved3 fixed1 changed
New
  • Gravity Forms Edit Access add-on: It's possible to set what forms is allowed to edit for the selected role.
  • Content view restrictions add-on: [user_role_editor] shortcode "roles" and "except_roles" attributes supports the "no_role" value for logged-in users with "No role for this site" - without any role granted.
Improved
  • Marked as compatible with WordPress 5.9.
  • PHP 7.3 is marked as required.
  • Core version was updated to version 4.61.1
  • If installed PHP/WordPress version is lower than required one, script termination ( wp_die() ) was replaced with notice-warning admin notice output.
  • "Settings->User Role Editor->Tools->Reset" button is additionally protected from the unintended/accidental usage by text input field. Manual input of "Permanently delete all custom user roles and capabilities" text is required to enable the "Reset" button.
  • Partial code review and refactoring according with WordPress & PHP coding standards.
Fixed
  • Content view restrictions add-on: PHP Warning: A non-numeric value encountered in /wp-content/plugins/user-role-editor-pro/pro/includes/classes/posts-view.php on line 224
  • Meta boxes access add-on: PHP Warning: A non-numeric value encountered in /wp-content/plugins/user-role-editor-pro/pro/includes/classes/meta-boxes.php on line 452
  • "Users->selected user->Capabilities" page: 'select all' checkbox did not work.
Changed
  • Core version: 4.61.1

2021 8 versions

4.60.2 21 Sep 2021 1 new2 improved4 fixed3 changed
New
  • URE user capability 'ure_edit_gravityforms_access' was added (for future use).
Improved
  • Marked as compatible with WordPress 5.8.1
  • Core version was updated to version 4.60.2
Fixed
  • Admin menu access add-on: Blocked admin menu item "SEO->Workouts" (from Yoast SEO plugin) was still available as main menu item.
  • Multisite: Add-ons data from the main site were not replicated to subsites after click "Update Network" button from the "Network Admin->Users->User Role Editor".
  • Navigation menus access add-on:
  • Multisite: URE_Editor::is_full_network_sync() returned FALSE, instead TRUE for the AJAX call, while call was made from the Network Admin (wp-admin/network/).
Changed
  • Core version: 4.60.2
  • - PHP Warning: Undefined variable $result in /wp-content/plugins/user-role-editor-pro/pro/includes/classes/nav-menus-admin-controller.php on line 28
  • - PHP Fatal error: Uncaught TypeError: Unsupported operand types: string + string in /wp-content/plugins/user-role-editor-pro/pro/includes/classes/nav-menus-admin-view.php:146
4.60.1 21 Jul 2021 2 improved2 fixed1 changed
Improved
  • Marked as compatible with WordPress 5.8.
  • Core version was updated to version 4.60.1
Fixed
  • If one of the pages on hierarchy tree was not published (draft) it may become unavailable for editing in spite of user can (is allowed) edit the parent page.
  • PHP Notice: Undefined property: URE_User_View::$multisite in /wp-content/plugins/user-role-editor/includes/classes/user-view.php on line 145
Changed
  • Core version: 4.60.1
4.60 28 Jun 2021 2 new2 improved3 fixed3 changed
New
  • Edit posts/pages/custom post types restrictions add-on: new custom filters were added: 'ure_post_edit_access_restricted_taxonomies', 'ure_post_edit_access_allowed_terms', 'ure_post_edit_access_terms_to_exclude'.
  • Notification box was replaced with one based on the jpillora/nofifyjs jQuery plugin. It does not move down page content. It disappears automatically after 5 seconds. Click on it to remove it manually.
Improved
  • Edit posts/pages/custom post types restrictions add-on:
  • Core version was updated to version 4.60
Fixed
  • WP Multisite: User lost granted roles after click "Users->Capabilities->Update Network".
  • "Add capability" shows warning styled notification when needed (invalid characters, etc.) instead of a successful one.
  • Capabilities group uncheck and revert selection is blocked for the administrator role to exclude accident deletion of permissions from administrator role.
Changed
  • Core version: 4.60
  • - It is compatible now with "Admin Columns" and "Advanced Custom Fields" plugins. "Admin columns" plugin did not showed "Advanced Custom Fields" managed column values, when URE applied edit restrictions. URE excludes now from edit restrictions ACF plugins custom post types 'acf-field-group' and 'acf-field'.
  • - It is compatible now with "Contact Form 7" plugin. You can restrict access to the CF7 plugin records the same way as to any other custom post type.
4.59.4 12 May 2021 2 new5 improved1 changed
New
  • Multisite: it's possible to leave selected roles for selected subsites unchanged after "Update Network" applied. Add filter 'ure_network_update_leave_roles' and return from it the array like this one - array( (int) blog_id => array('role_id1', 'role_id2', ... )
  • Multisite: When update role at the main site with "Apply to all sites" option and PHP constant URE_MULTISITE_DIRECT_UPDATE === 1 (update roles directly in database, not via WordPress API), URE overwrites all subsite roles with roles from the main site. It's possible now to leave selected role(s) for selected subsite(s) unchanged: add filter 'ure_network_update_leave_roles' and return from it th...
Improved
  • Posts/pages, custom post types edit restrictions add-on: child posts auto access takes into account all existing hierarchical post types, not only pages as earlier. Use 'ure_auto_access_children_for_hierarchical_post_types' filter in order to change this. It takes the single input parameter $hierarchical_post_types - the list of existing public hierarchical post types.
  • Core version was updated to version 4.59.1
  • "Other roles" section is available now only for users with 'promote_users' capability.
  • Notice at the top of URE page about action result is not removed automatically after 7 seconds as earlier.
  • 'ure_sort_wp_roles_list' filter accepts these values for the single input parameter: false - leave roles list as it is; true or 'id' - sort roles list by role ID; 'name' - sort roles by role name in the alphabetical order.
Changed
  • Core version: 4.59.1
4.59.3 7 Apr 2021 2 new3 improved1 fixed1 changed
New
  • Custom filter 'ure_set_cpt_own_caps' was added. It takes 2 input parameters: $do_it (bool, TRUE by default) and $post_type (string). Return FALSE for this filter in order to leave the default capability type for selected custom post type when option "Force custom post types to use their own capabilities" is turned ON at URE's options. If custom post type capabilities are not changed, related ta...
  • Custom filter 'ure_set_cpt_taxonomy_own_caps' was added. It takes 3 input parameters: $do_it (bool, TRUE by default), $taxonomy (string, like 'product_cat') and $post_type (string, like 'product'). Return FALSE for this filter in order to leave the default capabilities for selected taxonomy even if related custom post type will get own capabilities when option "Force custom post types to use th...
Improved
  • PHP constant URE_WP_ADMIN_URL was replaced with direct 'admin_url()' call to respect the 'admin_url' filter applied at get_admin_url() function.
  • Core version was updated to version 4.59
  • Editing roles and capabilities granted to selected user ("Capabilities" link under user row at the "Users" list) executes 'add_user_role' or 'remove_user_role' actions only in case it really grants or revokes roles and/or capabilities. Previous versions fully revoked and granted again all roles during user permissions update even in case roles list was not changed. It was leaded to the false ex...
Fixed
  • Navigation menus access add-on: action result message on success was not shown.
Changed
  • Core version: 4.59
4.59.2 2 Mar 2021 1 new5 improved3 fixed5 changed
New
  • URE automatically adds such capabilities to the 'administrator' role. You have to grant these new capabilities to other roles manually.
Improved
  • Option "Force custom post types to use their own capabilities" replaces default capabilities for the custom taxonomies also.
  • 'edit_css' capability is mapped to 'unfiltered_html' for WordPress multisite, in case 'Enable "unfiltered_html" capability' option is turned ON at the URE's settings 'Multisite' tab. This automatically enables for a single site (blog/subsite) admin the 'Additional CSS' tab at the 'Appearance->Customize' page.
  • Admin menu access add-on: New custom filter 'ure_admin_menu_access_not_block_url' is available. It allows to whitelist not selected URL (without path, like admin.php?page=mlw_quiz_options), which is not presented at the admin menu and it's not possible to select them with the "Block not Selected" model.
  • Core version was updated to version 4.58.3
  • URE automatically adds custom taxonomies user capabilities to administrator role before opening "Users->User Role Editor" page.
Fixed
  • "Multisite -> Update Network" did not work due to bug in version 4.59.
  • Posts/pages, custom post types edit restrictions add-on:
  • Role changes were not saved with option "Confirm role update" switched off.
Changed
  • Core version: 4.58.3
  • - Restricted user can some times see a full list of posts or pages due to internal caching issue.
  • - Media Library restricted items list did not take into account authors ID list restriction criteria for images loaded directly to the Media Library, which does not have parent posts.
  • - When products editing is restricted by product category/tag, product variations shown by "Admin Columns Pro - WooCommerce" plugin were not available. Now, if product is allowed, then related variations are allowed automatically too.
  • It takes the slug of the 1st post type associated with such taxonomy (e.g. 'video') and builds own capabilities this way: manage_terms->manage_video_terms, edit_terms->edit_video_terms, delete_terms->delete_video_terms, assign_terms->assign_video_terms.
4.59.1 26 Jan 2021 1 fixed1 changed
Fixed
  • Import single role: Uncaught TypeError: $ is not a function at HTMLDivElement.Import (import-single-role.js?ver=4.59:46) was fixed.
Changed
  • Core version 4.58.2
4.59 24 Jan 2021 6 improved6 fixed1 changed
Improved
  • Admin menu access add-on: Update button saves changes via AJAX without full page reload.
  • Nav menus admin access add-on: Update button saves changes via AJAX without full page reload.
  • Widgets admin access add-on: Update button saves changes via AJAX without full page reload.
  • All JavaScript files are loaded with URE plugin version number as a query string for cache busting purpose.
  • Core version was updated to 4.58.2
  • Users->User Role Editor: Update button saves changes via AJAX without full page reload.
Fixed
  • Widgets admin access add-on: "PHP Warning: A non-numeric value encountered in /wp-content/plugins/user-role-editor-pro/pro/includes/classes/widgets-admin-view.php on line 189" was fixed.
  • "JQMIGRATE: jQuery.fn.click() event shorthand is deprecated" notice was fixed.
  • "JQMIGRATE: jQuery.fn.submit() event shorthand is deprecated" notice was fixed.
  • New user registered via frontend (wp-login.php?action=register) automatically receives additional (other) default role(s) according to selection made at User Role Editor settings "Other default roles" tab.
  • "JQMIGRATE: jquery.fn.resize() event shorthand is deprecated" notice was fixed.
  • "JQMIGRATE: Number-typed values are deprecated for jQuery.fn.css( (property name), value )" notice was fixed.
Changed
  • Core version 4.58.2

2020 9 versions

4.58.2 14 Dec 2020 2 new2 improved2 fixed1 changed
New
  • Admin menu access add-on: ure_admin_menu_get_hashes filter was added (pro/includes/classes/admin_menu.php, line #105. URE uses internally the list of the links included into admin menu. Use this filter to modify it, in case you know what you do.
  • German Formal (de_DE_formal) translation was added.
Improved
  • JQuery MultiSelect plugin was updated to version 1.5.2
  • Core version was updated to 4.57.1
Fixed
  • PHP Warning: The magic method wakeup() must have public visibility. wakeup() method was defined as private as a part of the Singleton design partern. Method was redefined as public but with exception inside to prevent its usage.
  • Nextgen Gallery's user capabilities were not shown as granted after current role change via roles selection dropdown list.
Changed
  • Core version 4.57.1
4.58.1 30 Nov 2020 1 fixed1 changed
Fixed
  • Error message was fixed: Uncaught Error: Object of class stdClass could not be converted to string in /wp-content/plugins/user-role-editor-pro/pro/includes/classes/posts-edit-access-user.php:653
Changed
  • Core version 4.57
4.58 23 Nov 2020 4 improved2 fixed2 changed
Improved
  • Marked as compatible with WordPress 5.6.
  • " jQuery( document ).ready( handler ) " was replaced globally with " jQuery( handler ) " for compatibility with jQuery 3.0 and WordPress 5.6.
  • Post edit access add-on:
  • Core version was updated to 4.57:
Fixed
  • - Special support was added for the FooGallery plugin. Earlier new album, edit album pages showed full list of galleries in spite of the edit restrictions set by URE Pro. URE Pro uses 'foogallery_album_exlcuded_galleries' filter to fix this.
  • "Grant Roles" button produced JavaScript error, if single user without any role granted (None) was selected.
Changed
  • Core version 4.57
  • - SQL queries are restricted by post type (if known) instead of scan full posts database table.
4.57.1 7 Sep 2020 4 new1 improved2 fixed1 changed
New
  • WordPress multisite: "Network admin->User Role Editor->Update Network":
  • - 'ure_after_network_roles_update' action hook was added. It is executed after all roles were replicated from the main site to the all other subsites of the network.
  • - 'ure_after_network_addons_update' action hook was added. It is executed after selected add-ons settings were replicated from the main site to the all other subsites of the network.
  • WordPress multisite: Main site: Users->User Role Editor->Apply to All: 'ure_after_network_roles_update' action hook was added. It is executed after all roles were replicated from the main site to the all other subsites of the network.
Improved
  • Core version was updated to 4.56.1:
Fixed
  • "Granted Only" filter did not work at the "Users->User Role Editor" page.
  • Warning was fixed: wp-content/plugins/user-role-editor/js/ure.js: jQuery.fn.attr('checked') might use property instead of attribute.
Changed
  • Core version 4.56.1
4.57 11 Aug 2020 2 new3 improved1 fixed1 removed2 changed
New
  • Frond-end menu access add-on: default option "Show to" was extended to the selection between "Show to" and "Hide from" (If UI does not work as expected, force browser page refresh in order to load the latest version of front-end-menu-access.js).
  • User capabilities 'install_languages', 'resume_plugins', 'resume_themes', 'view_site_health_checks' were added to the list of supported WordPress built-in user capabilities.
Improved
  • Minor code updates/optimizations
  • Core version was updated to 4.56:
  • Single site WordPress installation: URE automatically grants all existing user capabilities to WordPress built-in 'administrator' role before opening its page "Users->User Role Editor".
Fixed
  • Extra slash was removed between URE_PLUGIN_URL and the image resource when outputting URE_PLUGIN_URL .'/images/ajax-loader.gif' at 'Users->User Role Editor' page.
Removed
  • Admin menu access add-on: empty menu/submenu items are removed automatically.
Changed
  • Core version 4.56
  • Info: Marked as compatible with WordPress 5.5.
4.56.2 6 Jun 2020 2 improved1 security1 changed
Improved
  • Core version was updated to 4.55.1:
  • URE_Uninstall class properties were made 'protected' to be accessible in URE_Uninstall_Pro class included into the Pro version.
Security
  • User with 'edit_users' capability could assign to another user a role not included into the editable roles list. This fix is required to install ASAP for all sites which have user(s) with 'edit_users' capability granted not via 'administrator' role.
Changed
  • Core version 4.55.1
4.56.1 5 Jun 2020 4 improved1 fixed1 changed
Improved
  • Widgets admin access: It's possible to use "Block not selected" access model to block widgets and sidebars which are not selected in the list.
  • User Role Editor Pro uninstallation was refactored. It fully removes the ('ure_%') user capabilities from the user roles data and users meta.
  • Core version was updated to 4.55
  • User Role Editor uninstallation was refactored. It fully removes the ('ure_%') user capabilities from the user roles data.
Fixed
  • Unfiltered_html enabled for multisite did not work when user saved content from Gutenberg. unfiltered_html activation code was not applied for WP REST API (AJAX) calls.
Changed
  • Core version 4.55
4.56 3 May 2020 1 new2 improved2 fixed4 changed
New
  • Quick filter hides capabilities, which do not contain search string
Improved
  • Core version was updated to 4.54:
  • CSS enhancement: When site has many custom post types capabilities list section maximal height is limited by real height of the left side (capabilities groups) section, not by 720px as earlier.
Fixed
  • Front-end menu access add-on:
  • Empty list of capabilities (0/0) was shown for custom post types (CPT) which are defined with the same capability type as another CPT.
Changed
  • Core version: 4.54
  • - Do not switch menu walker to custom one starting from WordPress version 5.4 as it natively supports 'wp_nav_menu_item_custom_fields' action.
  • - Do not duplicate UI elements output in case 'wp_nav_menu_item_custom_fields' action is executed more than one time - (for example, by external code incompatible with WordPress 5.4).
  • For example courses CPT from LearnDash plugin is defined with 'course' capability type (edit_courses, etc.) and other CPT from LearnDash were shown with 0/0 capabilities (lessons, topics, quizzes, certificates).
4.55.2 30 Mar 2020 1 fixed1 changed
Fixed
  • BbPress roles UI elements, like "Forum role", "Change forum role to..." were empty due to fix made with version 44.55.1.
Changed
  • Core version: 4.53.1